Policy enforcement for upstream flood traffic

Abstract

Systems, methods, and computer-readable media are provided for enforcing policy for upstream (e.g., traffic from an endpoint to the physical network layer or hardware fabric of a data center) flood traffic (e.g., broadcast, unknown unicast, or multicast traffic) originating from a virtual endpoint via a network fabric. In one embodiment, upstream flood traffic can be transmitted using a special multicast group to which only elements of the data center fabric (e.g., physical switches, routers) are subscribed. That is, upstream flood traffic is assigned to the special multicast group, resulting in unintended endpoints not receiving the flood traffic. However, the hardware fabric receives the flood traffic and will then enforce applicable policies to route the packets to intended endpoints.

What is claimed is: 
     
       1. A method comprising:
 obtaining network traffic from a source virtual endpoint to be forwarded to one or more destination endpoints, at least one of the one or more destination endpoints residing in a logical network associated with a network environment comprising a physical network and one or more logical networks; 
 determining the network traffic comprises encapsulated flood traffic, the encapsulated flood traffic comprising flood traffic and destination address information defining a multicast destination address for the encapsulated flood traffic, the multicast destination address being mapped to one or more elements in the physical network and excluding endpoints residing in the one or more logical networks, the multicast destination address steering the flood traffic through the one or more elements in the physical network prior to reaching the at least one of the one or more destination endpoints residing in the logical network; 
 mapping the source virtual endpoint to a first endpoint group and the one or more destination endpoints to a respective second endpoint group; 
 determining one or more policies between the first endpoint group and the respective second endpoint group; 
 applying the one or more policies via at least one of the one or more elements in the physical network associated with the multicast destination address; 
 determining the or more destination endpoints for the flood traffic; and 
 forwarding the flood traffic in the encapsulated flood traffic toward the one or more destination endpoints based at least in part on one or more destination addresses associated with the flood traffic. 
 
     
     
       2. The method of  claim 1 , wherein the physical network comprises a data center fabric and the multicast destination address is associated with a multicast group, the multicast group comprising nodes subscribed to the multicast group, the nodes subscribed to the multicast group comprise only nodes in the data center fabric. 
     
     
       3. The method of  claim 1 , wherein the one or more policies correspond to an allow, deny, redirect, change quality of service (QoS), encrypt, drop, or copy action. 
     
     
       4. The method of  claim 1 , wherein the network traffic is received from a virtual switch associated with the source virtual endpoint, and wherein the source virtual endpoint and the virtual switch are downstream from the physical network. 
     
     
       5. The method of  claim 4 , wherein the virtual switch is a virtual tunnel endpoint. 
     
     
       6. The method of  claim 1 , wherein the flood traffic comprises one or more broadcast, unknown unicast, or multicast frames. 
     
     
       7. The method of  claim 1 , wherein the physical network comprises a data center having one or more spine and leaf switches. 
     
     
       8. A system comprising:
 at least one processor; and 
 at least one non-transitory computer-readable storage medium having stored therein instructions that, upon being executed by the at least one processor, cause the at least one processor to: 
 receive traffic originating from a source virtual endpoint, the traffic being designated for one or more destination endpoints, at least one of the one or more destination endpoints residing in a logical network associated with a network environment comprising a physical network and one or more logical networks; 
 determine the traffic comprises encapsulated flood traffic, the encapsulated flood traffic comprising flood traffic and destination address information defining a multicast destination address for the encapsulated flood traffic, the multicast destination address being mapped to one or more elements in the physical network and excluding endpoints residing in the one or more logical networks, the multicast destination address steering the flood traffic through the one or more elements in the physical network prior to reaching the at least one of the one or more destination endpoints residing in the logical network; 
 map the source virtual endpoint to a first endpoint group and the one or more destination endpoints to a respective second endpoint group; 
 determine one or more policies between the first endpoint group and the respective second endpoint group; 
 enforce the one or more policies via at least one of the one or more elements of the physical network; 
 determine the one or more destination endpoints associated with the flood traffic; and 
 forward the flood traffic in the encapsulated flood traffic toward the one or more destination endpoints based at least in part on one or more destination addresses associated with the flood traffic. 
 
     
     
       9. The system of  claim 8 , wherein the instructions upon being executed further cause the at least one processor to:
 perform a lookup for the one or more policies based on the first endpoint group and the respective second endpoint group. 
 
     
     
       10. The system of  claim 8 , wherein the multicast destination address corresponds to a multicast group, wherein the instructions upon being executed further cause the at least one processor to:
 configure the multicast group such that no endpoints in the one or more logical networks can subscribe to the multicast group. 
 
     
     
       11. The system of  claim 8 , wherein the traffic is received from at least one of a virtual switch or a virtual tunnel endpoint. 
     
     
       12. The system of  claim 8 , wherein the physical network comprises a Clos or spine-leaf network. 
     
     
       13. The system of  claim 8 , wherein the source virtual endpoint is downstream from the physical network, the physical network comprising a network fabric. 
     
     
       14. The system of  claim 8 , further comprising:
 a virtual switch associated with a same logical or virtual network as the source virtual endpoint, the virtual switch being configured to: 
 receive the flood traffic from the source virtual endpoint; 
 encapsulate the flood traffic with the destination address information to yield the encapsulated flood traffic; and 
 forward the encapsulated flood traffic towards the physical network based on the destination address information. 
 
     
     
       15. The system of  claim 14 , wherein the same logical or virtual network comprises an overlay network, and wherein the physical network comprises a network fabric. 
     
     
       16. A non-transitory computer-readable storage medium having stored therein instructions that, upon being executed by a at least one processor, cause the at least one processor to:
 obtain network traffic associated with a source virtual endpoint, the network traffic to be forwarded to one or more destination endpoints, at least one of the one or more destination endpoints residing in a logical network associated with a physical network; 
 determine the network traffic comprises encapsulated flood traffic including flood traffic and destination information corresponding to a multicast group for the encapsulated flood traffic, the multicast group comprising one or more elements of the physical network and excluding endpoints residing in the logical network, the destination information comprising a network address for steering the flood traffic through the one or more elements in the physical network prior to reaching the at least one of the one or more destination endpoints residing in the logical network; 
 map the source virtual endpoint to a first endpoint group and the one or more destination endpoints to a respective second endpoint group; 
 determine one or more policies between the first endpoint group and the respective second endpoint group; 
 apply the one or more policies via at least one of the one or more elements in the physical network; 
 determine the or more destination endpoints associated with the flood traffic; and 
 forward the flood traffic in the encapsulated flood traffic toward one or more destination endpoints based at least in part on one or more destination addresses associated with the flood traffic. 
 
     
     
       17. The non-transitory computer-readable storage medium of  claim 16 , wherein the instructions upon being executed further cause the at least one processor to:
 encapsulate the flood traffic with the network address to yield the encapsulated flood traffic; and 
 forward the encapsulated flood traffic based on the network address in the encapsulated flood traffic. 
 
     
     
       18. The non-transitory computer-readable storage medium of  claim 16 , wherein the one or more policies are based on a whitelist model. 
     
     
       19. The non-transitory computer-readable storage medium of  claim 16 , wherein the physical network comprises one or more spine switches and leaf switches, wherein the one or more leaf switches and spine switches are interconnected. 
     
     
       20. The non-transitory computer-readable storage medium of  claim 16 , wherein the one or more policies correspond to an allow, deny, redirect, change quality of service (QoS), encrypt, drop, or copy action.